Menu QaldyDocs

Bitrix24 (inbound webhook)

Create leads and read deals in Bitrix24.

  • Status: Available
  • Shelf: CRM
  • How you connect: Webhook URL
  • Regions: global and Kazakhstan
  • The service’s own API reference: https://apidocs.bitrix24.com/

Apps create leads and read deals in your Bitrix24 through an inbound webhook. The webhook URL is the credential: https://<portal>.bitrix24.<tld>/rest/<user>/<code>/. Qaldy seals <user>/<code> to the gate and the gate puts it into the URL path (path_token auth), so the app never sees it.

Status: Available through the HTTP API preset. The preset follows Bitrix24's REST webhook documentation (checked 2026-10-16). It has not been run against a live portal.

Connect it

  1. In Bitrix24 open Developer resources → Other → Inbound webhook (apidocs.bitrix24.com).
  2. Tick only the permissions the apps need (for leads and deals: crm). The webhook's scopes are the real fence on what an app can do; the gate's host and path fence is the second.
  3. Copy the webhook URL.
  4. Qaldy → Connectors → Bitrix24 → Connect Bitrix24 → paste the whole URL → Seal and connect. Qaldy reads your portal (acme.bitrix24.kz) and the secret (1/abcdefghijklmnop) from it; anything after the secret (a method name) is dropped. Only the secret is sealed, and it is never shown again.

Test connection calls GET /rest/<secret>/profile.json, which answers for any valid webhook.

What the gate allows

Hostyour portal, as pasted (<portal>.bitrix24.<tld>), base path /rest (pinned, every resolved address public; IP literals and private names are refused)
MethodsGET, POST
Pathsthe REST method the app names (/crm.lead.add.json, /crm.deal.list.json)
Secretspliced into the path by the gate: /rest/<user>/<code>/<method>; the app can't read, replace or climb out of it

Use it from an app

json
{ "id": "http", "actions": ["request"], "scope": "conn_k3v9…" }
ts
const api = ctx.connectors.http('conn_k3v9…')
await api.post('/crm.lead.add.json', { json: { fields: { TITLE: 'Website lead', NAME: 'Aigerim' } } })
const deals = await api.post('/crm.deal.list.json', { json: { filter: { STAGE_ID: 'NEW' } } })

Bitrix24 puts the reason in an error field (with an error_description) of the reply; the connector throws it as an upstream_error carrying that message. With throwOnError: false, read res.body.error yourself.

When it breaks

You seeWhyDo
error: "INVALID_CREDENTIALS" or 401The webhook was deleted or the code mistypedCreate a new webhook and replace the secret
error: "insufficient_scope"The webhook lacks a permissionEdit its permissions in Bitrix24
Setup says "The address is missing its secret part"The pasted URL has no <user>/<code>Copy the whole URL from Inbound webhook

Type to search. Up and down to choose, Enter to open, Esc to close.